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DATA PROTECTION ACT 1998 
SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER 


ENFORCEMENT NOTICE 


To: Repair & Assure Ltd 


Of: Suite C, Second Floor, Redhill Chambers, 2d, High Street, Redhill 
RH1 1R) 


1. The Information Commissioner (“Commissioner”) has decided to issue 
Repair & Assure Ltd (“RAL”) with an enforcement notice under section 
40 of the Data Protection Act 1998 (“DPA”). The notice is in relation to 
a contravention of regulation 21 of the Privacy and Electronic 


Communications (EC Directive) Regulations 2003. 


2. This notice explains the Commissioner’s decision. 


Legal framework 


3. RAL, whose registered office address is given above (Companies House 
Registration Number: 10539230), is the organisation stated in this 
notice to have used a public electronic communications service for the 
purpose of making unsolicited calls for the purposes of direct marketing 


contrary to regulation 21 of PECR. 


4. Regulation 21 applies to the making of unsolicited calls for direct 


marketing purposes. It means that if a company wants to make calls 
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promoting a product or service to an individual who has a telephone 
number which is registered with the Telephone Preference Service Ltd 


(“TPS”), then that individual must have given their consent to that 


company to receive such calls. 
5. Regulation 21 paragraph (1) of PECR provides that: 


“(1) A person shall neither use, nor instigate the use of, a public 
electronic communications service for the purposes of making 


unsolicited calls for direct marketing purposes where- 


(a) the called line is that of a subscriber who has previously 
notified the caller that such calls should not for the time being 


be made on that line; or 


(b) the number allocated to a subscriber in respect of the called 


line is one listed in the register kept under regulation 26.” 
6. Regulation 21 paragraphs (2), (3), (4) and (5) provide that: 


“(2) A subscriber shall not permit his line to be used in contravention 


of paragraph (1). 


(3) A person shall not be held to have contravened paragraph (1)(b) 
where the number allocated to the called line has been listed on the 
register for less than 28 days preceding that on which the call is 


made. 


(4) Where a subscriber who has caused a number allocated to a line of 
his to be listed in the register kept under regulation 26 has notified 


a caller that he does not, for the time being, object to such calls 
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being made on that line by that caller, such calls may be made by 


that caller on that line, notwithstanding that the number allocated 


to that line is listed in the said register. 


(5) Where a subscriber has given a caller notification pursuant to 


paragraph (4) in relation to a line of his— 


(a) the subscriber shall be free to withdraw that notification at any 
time, and 
(b) where such notification is withdrawn, the caller shall not make such 


calls on that line.” 


Under regulation 26 of PECR, the Commissioner is required to maintain 
a register of numbers allocated to subscribers who have notified them 

that they do not wish, for the time being, to receive unsolicited calls for 
direct marketing purposes on those lines. The TPS is a limited company 
set up by the Commissioner to carry out this role. Businesses who wish 
to carry out direct marketing by telephone can subscribe to the TPS for 


a fee and receive from them monthly a list of numbers on that register. 


Section 122(5) of the DPA 2018 defines direct marketing as “the 
communication (by whatever means) of advertising material which is 
directed to particular individuals”. This definition also applies for the 


purposes of PECR. 


Consent is defined in Article 4(11) the General Data Protection 
Regulation 2016/679 as “any freely given, specific, informed and 
unambiguous indication of the data subject’s wishes by which he or 
she, by a statement or by a clear affirmative action, signifies 


agreement to the processing of personal data relating to him or her. 
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The DPA contains enforcement provisions at Part V which are 


exercisable by the Commissioner. Those provisions are modified and 
extended for the purposes of PECR by Schedule 1 PECR. 


Section 40(1)(a) of the DPA (as extended and modified by PECR) 
provides that if the Commissioner is satisfied that a person has 
contravened or is contravening any of the requirements of the 
Regulations, she may serve him with an Enforcement Notice requiring 
him to take within such time as may be specified in the Notice, or to 
refrain from taking after such time as may be so specified, such steps 


as are so specified. 


The provisions of the DPA remain in force for the purposes of PECR 
notwithstanding the introduction of the Data Protection Act 2018 (see 
paragraph 58(1) of Part 9, Schedule 20 of that Act). 


The contravention 


The Commissioner finds that RAL has contravened regulation 21 of 
PECR. 


The Commissioner finds that the contravention was as follows: 


Between 2 January 2019 and 11 June 2019, RAL used a public 
telecommunications service for the purposes of making 1,103,292 
unsolicited calls to subscribers for direct marketing purposes to 
subscribers where the number allocated to the subscriber in respect of 
the called line was a number listed on the register of numbers kept by 
the Commissioner in accordance with regulation 26, contrary to 
regulation 21(1)(b) of PECR. 
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The Commissioner is also satisfied for the purposes of regulation 21 
that these 1,103,292 unsolicited direct marketing calls were made to 
subscribers who had registered with the TPS at least 28 days prior to 


receiving the calls, and they had not given their prior consent to RAL to 


receive calls. 


The Commissioner is further satisfied that there were a total of 88 


complaints to the TPS and ICO arising from these calls. 
The content of the complaints included the following: 


e “My elderly mother was cold-called [...] from Repair & Assure 
regarding insurance for her washing machine. As her machine is 
very old, this made no sense to her. And as she had no recollection 
of ever dealing with this company before, she was very concerned 
that they already knew her name, address and telephone number. 
During the call, [name redacted] also asked my mother if she had a 
mobile, email or direct debit - all details of which my mother did not 


give. She terminated the call shortly after.” 


e “The caller, male, told me my washing machine manufacturer 
warranty was about to expire and they wanted to continue it with a 
35% discount. | asked who the company were and he told me. | 
then said | didn't have any cover with them to continue with and he 
apologised for phrasing it like that. | then said | was registered with 
the TPS so he shouldn't be calling me and he said all | had to say 
was do | want the cover or not! | said no and that | would be 


reporting the call.” 


e “Caller enquired about Hotpoint washing machine that | do not own. 
| own a Zanussi. Prior to any sales pitch, | had informed the caller 


that he was breaking the rules/laws regarding restricted numbers 
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and sales calls. He said he was not. | informed him that my number 
is on the TPS service and that by calling he was indeed breaching 
the law regarding this. He again attempted to continue the call at 


which point | put the phone down on him.” 


e “Caller wanted to talk about my washing machine! | told him that | 
did not have such a device and used the local launderette. He called 
me a liar. | told him | was TPS registered and | put the phone down. 
| had received a "silent call" from the same number earlier at 10:29, 


which | have reported to Ofcom.” 


The data used by RAL for the purposes of its direct marketing calls was 
obtained from its twelve data suppliers. To obtain its data, the data 
suppliers sought to carry out telephone surveys with individuals. RAL 
has attempted to provide evidence, albeit unclear evidence, to the 
Commissioner of how four of its twelve data suppliers obtained the 
data which they used for their initial survey calls, but has provided 


nothing for the remaining eight data suppliers used. 


The Commissioner is satisfied that the calls carried out by the data 
suppliers are clearly for the intention of collecting data for use in future 
marketing campaigns (by organisations such as RAL). During these 
calls individuals would be asked to answer some ‘household questions’ 
or to give a ‘valid opinion’ on “leading UK brands”. Once the individual 
agrees to participate in the survey they are asked to confirm their 
personal details, and then provide information regarding their washing 
machine. The Commissioner has been provided with some data 
supplier call samples and whilst RAL are mentioned briefly in the 
samples provided, the Commissioner is concerned that the way in 
which these consents were obtained renders it not sufficiently specific, 


informed or freely given. 


21. 


22. 


23. 


1CO. 


Information Commissioner's Office 


The Commissioner’s direct marketing guidance is very clear that 
informed consent cannot be established when an individual has been 
asked to agree to third party marketing prior to being informed who 
the third-party organisations actually are. In terms of the data supplier 
surveys, not only are the third parties provided after the apparent 
consent is obtained, but the data suppliers have conflated the 
agreement to marketing with a more veiled request to individuals to 
provide an ‘opinion’ or to answer ‘household questions’ about “UK 
leading brands”. This strategy of being deliberately opaque about the 
purpose of the call is misleading, and makes it difficult for anybody 
seeking to rely on that consent to demonstrate that the individuals 
could have known precisely what they were agreeing to when they 


agreed to answer some ‘household questions’. 


The Commissioner is further concerned that the ‘third party data 
agreements’ between RAL and the suppliers are not dated before 22 
March 2019, suggesting that there were no such agreements in place 
prior to that date. The Commissioner has clear evidence that calls 
were being made at least as early as 2 January 2019 for the purposes 
of this contravention (with evidence of complaints being made 
significantly earlier) and since no evidence of valid consent has been 
provided, and RAL have confirmed that no TPS checks were undertaken 
prior to making its calls, the Commissioner has concluded that the 


1,103,292 direct marketing calls were not made lawfully 


The Commissioner has considered, as she is required to do under 
section 40(2) of the DPA (as extended and modified by PECR) when 
deciding whether to serve an Enforcement Notice, whether any 
contravention has caused or is likely to cause any person damage. The 


Commissioner has decided that it is unlikely that actual damage has 
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been caused in this instance, but notes the distress prevalent in some 


of the complaints received about RAL’s activities. 


24. In view of the matters referred to above the Commissioner 
hereby gives notice that, in exercise of her powers under 
section 40 of the DPA, she requires RAL to take the steps 


specified in Annex 1 of this Notice. 


Right of Appeal 


25. There is aright of appeal against this Notice to the First-tier Tribunal 
(Information Rights), part of the General Regulatory Chamber. 


Information about appeals is set out in the attached Annex 2. 
Dated the 25" day of January 2021. 


Andy Curry 

Head of Investigations 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 
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ANNEX 1 
TERMS OF THE ENFORCEMENT NOTICE 
RAL shall within 30 days of the date of this notice: 
Neither use, nor instigate the use of, a public electronic 
communications service for the purposes of making unsolicited calls for 


direct marketing purposes where the called line is that of: 


(a) a subscriber who has previously notified RAL that such calls should 


not be made on that line; and/or 


(b) a subscriber who has registered their number with the TPS at least 
28 days previously and who has not notified RAL that they do not 


object to such calls being made. 
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ANNEX 2 


RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 


ni Section 48 of the Data Protection Act 1998 gives any person upon 
whom an enforcement notice has been served a right of appeal to the 
First-tier Tribunal (Information Rights) (the “Tribunal”) against the 


notice. 
2. If you decide to appeal and if the Tribunal considers: - 


a) that the notice against which the appeal is brought is not in 


accordance with the law; or 


b) to the extent that the notice involved an exercise of discretion by 
the Commissioner, that she ought to have exercised her 


discretion differently, 


the Tribunal will allow the appeal or substitute such other decision as 
could have been made by the Commissioner. In any other case the 


Tribunal will dismiss the appeal. 


3. You may bring an appeal by serving a notice of appeal on the Tribunal 


at the following address: 


General Regulatory Chamber 
HM Courts & Tribunals Service 
PO Box 9300 


Leicester 
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LE1 8D) 


Telephone: 0300 123 4504 


Email: grc@justice.gov.uk 


e The notice of appeal should be served on the Tribunal within 28 


days of the date on which the enforcement notice was sent 


The statutory provisions concerning appeals to the First-tier Tribunal 
(General Regulatory Chamber) are contained in sections 48 and 49 of, 
and Schedule 6 to, the Data Protection Act 1998, and Tribunal 
Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 
2009 (Statutory Instrument 2009 No. 1976 (L.20)). 
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